This website requires certain cookies to work and uses other cookies to help you have the best experience. By visiting this website, certain cookies have already been set, which you may delete and block. By closing this message or continuing to use our site, you agree to the use of cookies. Visit our updated privacy and cookie policy to learn more.

This Website Uses CookiesBy closing this message or continuing to use our site, you agree to our cookie policy. Learn MoreThis website requires certain cookies to work and uses other cookies to help you have the best experience. By visiting this website, certain cookies have already been set, which you may delete and block. By closing this message or continuing to use our site, you agree to the use of cookies. Visit our updated privacy and cookie policy to learn more.

Best Practices, Challenges and a Look at How Two Organizations Are Handling Mass Notification.

Between the mudslides in California and both Hawaii’s and Japan’s false missile warnings, mass notification has been at the forefront of recent news. In California, Santa Barbara County officials decided not to send out emergency cellphone messages about the incoming flooding until it had already started, worried about the reception yet more notifications would get from residents who had just returned from evacuating their homes after wildfires. Unfortunately, at least 20 people have died and several are still missing as of this writing.

In Hawaii, the alert that a ballistic missile was headed toward the island was mistakenly sent out by a Hawaii Emergency Management Agency (HI-EMA) employee, causing terror-stricken residents to seek shelter for an entire 38 minutes before they were alerted that it was a false alarm. The Japan snafu, which was posted on public broadcaster NHK’s website and sent out to cellphone users subscribed to the service, was chalked up to the incorrect operation of equipment and was corrected within five minutes.

All of these incidents have inspired conversations about how mass notification is used to alert people about emergency situations. How many alerts are too many, contributing to complacence? How does an agency like HI-EMA earn back credibility after such a horrendous mistake? When is the right time to send messages out? How much geographical area should the message cover to ensure everyone is out of harm’s way? These are all questions with answers that are still unfolding.

An Important Tool for Organizations

Rick Wimberly, president of Galain Solutions, led the team that wrote the outreach plan for FEMA’s IPAWS (Integrated Public Alert Warning System) and believes more organizations can and should take advantage of utilizing IPAWS alerts. Photo courtesy of Rick Wimberly

In the meantime, organizations of all sizes and cultures continue to utilize mass notification. Though it’s not limited to emergency notifications, of course, that’s probably the context most people associate mass notification with. It can be used to notify people about anything from toilets overflowing to servers being down to an active shooter to inclement weather.

“Just about every organization has some type of need to notify its people, the people it does business with and perhaps the people in the vicinity of the organization about hazards,” says Rick Wimberly, president of Galain Solutions. “I think the type and number of organizations that realize this is an important part of their business continuity grows constantly.” Indeed, the global market for mass notification is expected to steadily increase from $4.23 billion in 2017 to more than $11 billion by 2027, according to Future Market Insights.

“Consistency is key in mass notifications,” says James DeMeo, founder, president and CEO of USESC. Photo courtesy of James DeMeo

“Communications must be clear, concise and accurate, even though the situation can be ever changing and ever evolving,” says James DeMeo, founder, president and CEO of Unified Sports and Entertainment Security Consulting (USESC) and author of “What’s Your Plan?.” “Being out front, being transparent is key in order to gain confidence and trust from the receiver.”

Technology has made the ability to get messages out instantaneously and often simply by the push of a button. “Things are in real time. We’re gathering real-time intelligence, and we’re analyzing that intelligence, but we’re also educating people that much more quickly because of these platforms,” says DeMeo. “When you look at Facebook and Twitter and Instagram, you can reach a very, very large audience in a short amount of time by effectively utilizing these platforms through a large mass notification system.”

Challenges

Not only does technology constantly and consistently change, but so do people’s communication preferences, says Wimberly. “Even slow adopters are using new and creative things, so that presents both a challenge and an opportunity. The challenge is that (organizations) have to make sure that they’re not only creating notifications on all of the devices and all of the available methods, but that they’re doing this in a smart, logical way so that people will actually respond to the messages,” he says.

“Not only does technology constantly and consistently change, but so do people’s communication preferences.”

Keeping contact information current is another huge challenge for organizations, including Cleveland Clinic, says David Evans, program manager of Emergency Management for the Department of Protective Services. “It can be challenging to keep up with 52,000 caregivers, but we are constantly encouraging them to make sure that their contact information is up-to-date and letting them know the importance of being able to receive those emergency alerts,” he says.

Best Practices

Make sure you have top-level approval. Both DeMeo and Wimberly believe that getting everyone on board, particularly those at the top level, is essential to success. “If you don’t have someone at a senior executive level endorsing the project, it will not be successful,” says Wimberly. “Something like this touches all aspects of an organization, and so you have to have senior engagement to get all aspects of the organization on the same page.”

Know your organization’s needs. “There’s a lot of flexibility and a lot of capability available, so make sure that your approach conforms to the needs of the organization,” Wimberly says.

Understand the whys. Each organization needs to look deeply into why they’re using mass notification, as well as their practices, policies and procedures, Wimberly says. Developing a hierarchy for notifications that includes levels of severity so you’re not sending out notifications to everyone constantly is essential, as is breaking down who needs to know what, where and when.

Be willing to use multiple channels. Realistically, because you can’t possibly know the preferences of every individual you want to notify, you’re going to have to use a variety of ways to notify people. “I’m an evangelist for a concept called ‘ubiquitous alerts.’ This is basically a concept that alerts should be everywhere, on anything that can communicate with the internet,” says Wimberly.

Training and practice lead to success. “What you do in practice is how you will respond in a real life threatening situation,” DeMeo says. Evans sees this in his organization too. “Low frequency, high impact, monthly simulation training is imperative and extremely important to our communications officers because there’s little to no warning sometimes when situations occur, and we need to think on our feet and just go ahead and send a message correctly and accurately,” he says.

Leverage the systems you already have in place. Matt Arthur, director of incident communications solutions at Washington University in St. Louis, Missouri, says his organization has been able to utilize existing resources for their emergency notifications in a big way, most notably, by using the school’s app. Instead of getting a separate application for emergency notifications, Arthur was able to integrate them into the school’s existing app. “That was, quite frankly, the greatest use of existing technology that we could have done,” he says. “It’s a great tool that we have for parents, students, staff and faculty, and money for it didn’t have to come out of emergency management.”

Develop organizationally appropriate policies and procedures. “All emergencies eventually become information that needs to have the gaps filled and given more explanation,” says Arthur. “You need to develop systems so that process can work effectively without being reliant on just one individual.” At Washington University, they have a crisis management team that’s authorized to make certain operational decisions whenever there’s a crisis.

Washington University

Washington University uses a broad array of technologies for its mass notification systems, including email, texting, computer pop-ups, voice alerts, ADA-compliant siren systems, cable TV, a robust website, social media and, in particular, its WUSTL app. Combining the school’s regular app with emergency notifications has proven to be efficient and effective, says Arthur. “As long as you don’t opt out of notifications, you’ll get that alert right on your phone, and it works better, faster and more dependably than texting,” he says.

“Our goal and our expectation is that word of mouth is one of these methods of communication,” says Matt Arthur, director of incident communications solutions at Washington University, St. Louis. Photo courtesy of Matt Arthur

Students, staff and faculty are able to opt out of being notified on their personal emails and numbers, but they can’t opt out of notifications on any university-owned devices or emails. As students watch less cable TV, the team is looking at possibly switching to IPTV, Arthur says. “If I can’t tie into my umbrella system through API, then it’s probably not something I’m going to look at too closely.”

In the early days of utilizing their system, Arthur says there was a tornado heading toward one of the campuses. The alerts went out and were received, but no one was taking it seriously. Arthur called over to tell them they needed to get everyone in the stairwells and basement, so they complied. “After about an hour, I got another phone call. They had been down in the stairwell, but nobody had called them to tell them it was okay,” he says.

“So part of this maturation process has been a maturation of expectations. The system worked, it did what it was supposed to do, but the realistic expectation of the staff involved at that building, the two hadn’t met.” Human resources worked hard after that to come up with policies that make it clear that personal safety is of utmost important. “There’s always a learning curve, and you can always find ways to do things better, and technology is not always the sole answer,” Arthur says.

Cleveland Clinic

Because safety is of vital importance at Cleveland Clinic, utilizing a mass notification system was a given, says Evans. Full implementation took about two years using a tiered approach. First, they focused on incident management, which took a couple months, then on caregiver mass notification, and finally on text opt-in capability for patients and visitors. “If anything is happening around the area or within the hospital campuses themselves, patients and visitors will also be in the know,” he says.

“Robust plans have to be developed, implemented and tested on an ongoing basis,” says David Evans, program manager of Emergency Management at Cleveland Clinic. Photo courtesy of Cleveland Clinic

The team has noted that text messaging is the most efficient and effective way to communicate with caregivers, even though there are calling capabilities. “If they’re in a meeting or they’re off campus or they’re unable to pick up the phone, they can just look at it and see what’s going on, what type of emergency, and respond appropriately, if need be,” Evans says.

The team has also set up their system so that the communication officer can send out either a customized message or a preset one, depending on the situation. There’s a work leader to look over and double check the notifications as well. “We try to take out as much of the administrative work as possible when it comes to real life situations. For example, if somebody on the authorization list calls in and wants a customized, specific message sent to only a specific facility, the communications officer just pulls up the location, types in the message, clicks send, and everything is already done administratively in the background,” says Evans.

When the Republication National Convention came to Cleveland recently, the organization was ready for anything. “We had specified scenarios all ready to go,” Evans says. “We didn’t activate those specific scenarios, but the screen was up and we were ready to hit the send button on almost any type of situation that could have happened in downtown Cleveland.” The emergency management department also uses their mass notification system for severe weather notices, utility outages and incident management activations.

Events

A critical event is defined as an incident that disrupts normal operations, such as severe weather, crime, violence and critical equipment or technology failures. Business continuity and crisis response plans can only go so far if there isn't buy-in across functions, with executive-level support.

In this webinar, security expert Pieter Danhieux explores how CISOs and CIOs can inspire real change, fostering a positive security culture that enables their development teams to become more security-aware, more aligned with internal AppSec specialists and, ultimately, securing code as it is written.

Products

Effective Security Management, 5e, teaches practicing security professionals how to build their careers by mastering the fundamentals of good management. Charles Sennewald brings a time-tested blend of common sense, wisdom, and humor to this bestselling introduction to workplace dynamics.

Our special report this month features 26 security leaders who are changing the industry, inspiring many and leading with innovation. Security experts discuss the CCPA, public-private relationships, mobile device security and how aware employees can mitigate active shooter events and workplace violence.